Dashboards & Visualizations

How to append in stringreplace Advanced XML

mjohanne
Explorer

Hello,

I am trying to modify a custom UI that uses a HiddenSearch and fields to fill its values. For one of the fields if a user enters a value ("123" for example) we need to create the search token to look like "source=*\\ID_123\\*". If the field is left blank than nothing is added.

Using the prefix option in stringreplace I am able to get part of what is needed (source=*\\ID_123), but can not find a way to get the "\\*" appended.

See code snippets below. Any suggestions on how this can be done?

Thanks in advance.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">index=aqua $instanceToken$ $reverseToken$</param>

<module name="ExtendedFieldSearch">
  <param name="field">Instance</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="instanceToken">
        <param name="fillOnEmpty">false</param>
        <param name="prefix">source=*\\</param>
      </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="instanceToken">
        <param name="value">$instanceToken$</param>
      </param>
    </param>
  </param>
1 Solution

Johnvey
Contributor

Add a matching suffix parameter to your config:

    <param name="fillOnEmpty">false</param>
    <param name="prefix">source=*\\</param>
    <param name="suffix">\\*</param>

As you've already done, the fillOnEmpty flag will prevent anything from being injected if the user has not entered anything into the text box.

View solution in original post

Johnvey
Contributor

Add a matching suffix parameter to your config:

    <param name="fillOnEmpty">false</param>
    <param name="prefix">source=*\\</param>
    <param name="suffix">\\*</param>

As you've already done, the fillOnEmpty flag will prevent anything from being injected if the user has not entered anything into the text box.

mjohanne
Explorer

Thanks, that got it working.

0 Karma

sideview
SplunkTrust
SplunkTrust

If you install the Sideview Utils app, this becomes a lot easier with its TextField module. There's probably a way to do a suffix in ExtendedFieldSearch but it's not in the replacement map, and I dont think you can just put a 'suffix' into the stringreplace intention, and that would leave hardwiring it in the HiddenSearch which isnt a very good idea.

Here's the equivalent config in Sideview Utils. It's a bit easier as you see. Note that either way you almost certainly will need to backslash-escape those backslashes.

<module name="TextField">
  <param name="name">source</param>
  <param name="template">$name$="*\\\\$value$\\\\*"</param>
  <param name="label">Source:</param>
  ....

With the TextField module, you can just refer to this token (in all it's source="*\\*" glory), within Sideview's Search module, just by $source$. You wont need any intentions if you use both the TextField module instead of ExtendedFieldSearch, and the Search module instead of HiddenSearch.

You also may want to debug the token so that you can check that the backslash escaping is working. You can do that just by putting an HTML module inside the TextField, like so:

<module name="TextField">
  <param name="name">source</param>
  <param name="template">$name$="*\\\\$value$\\\\*"</param>
  <param name="label">Source:</param>
  <module name="HTML">
    <param name="html"><![CDATA[
      Debugging: <br>
      (use this when you're doing search language in Search or PostProcess)<br>
      source = $source$ <br>
      <br>
      (use this when you're making headers for the user)<br>
      source.rawValue = $source.rawValue$  <br>

    ]]></param>
  </module>
  ....

mjohanne
Explorer

Thanks for the info, I will look at Sideview for use in the future.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...